From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Date: Thu, 14 Mar 2013 22:24:45 +0900 Message-ID: <87k3pagllu.wl%satoru.takeuchi@gmail.com> From: Satoru Takeuchi To: Rusty Russell Cc: Satoru Takeuchi , Greg Kroah-Hartman , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Aurelien Jarno , Matt Mackall , Herbert Xu Subject: [PATCH] hw_random: free rng_buffer at module exit In-Reply-To: <87txoetre6.fsf@rustcorp.com.au> References: <20130312223211.492954675@linuxfoundation.org> <20130312223212.790278686@linuxfoundation.org> <874ngeykp6.wl%satoru.takeuchi@gmail.com> <87txoetre6.fsf@rustcorp.com.au> MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: At Thu, 14 Mar 2013 17:11:21 +1030, Rusty Russell wrote: > > Satoru Takeuchi writes: > > Hi Rusty, > > > > At Tue, 12 Mar 2013 15:43:33 -0700, > > Greg Kroah-Hartman wrote: > >> @@ -307,6 +312,14 @@ int hwrng_register(struct hwrng *rng) > >> > >> mutex_lock(&rng_mutex); > >> > >> + /* kmalloc makes this safe for virt_to_page() in virtio_rng.c */ > >> + err = -ENOMEM; > >> + if (!rng_buffer) { > >> + rng_buffer = kmalloc(rng_buffer_size(), GFP_KERNEL); > > > > rng_buffer is now kmalloc-ed, but not kfree-ed. Shoudn't it be kfree-ed > > at hwrng_unregister()? If my suspect is correct, the same problem is > > in 3.8.3-rc1 and 3.0.69-rc1. I'm OK to make a patch, but it'll be after > > some hours. > > > > Corecct me if I'm wrong. > > Yes, it would be nice to free it, but it really makes sense to free it > in module_cleanup() (which would have to be written, as the module > currently doesn't have one). > > Cheers, > Rusty. From: Satoru Takeuchi rng-core module allocates rng_buffer by kmalloc() since commit f7f154f1246ccc5a0a7e9ce50932627d60a0c878. But this buffer won't be freed and there is a memory leak possibility at module exit. Signed-off-by: Satoru Takeuchi Cc: Rusty Russell Cc: Matt Mackall Cc: Herbert Xu Cc: Aurelien Jarno Cc: Greg Kroah-Hartman Cc: stable@vger.kernel.org --- drivers/char/hw_random/core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c index 69ae597..a0f7724 100644 --- a/drivers/char/hw_random/core.c +++ b/drivers/char/hw_random/core.c @@ -380,6 +380,15 @@ void hwrng_unregister(struct hwrng *rng) } EXPORT_SYMBOL_GPL(hwrng_unregister); +static void __exit hwrng_exit(void) +{ + mutex_lock(&rng_mutex); + BUG_ON(current_rng); + kfree(rng_buffer); + mutex_unlock(&rng_mutex); +} + +module_exit(hwrng_exit); MODULE_DESCRIPTION("H/W Random Number Generator (RNG) driver"); MODULE_LICENSE("GPL"); -- 1.7.10.4